You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Register a free account to unlock additional features at BleepingComputer.com

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

Right click the DelDomains.inf file and click Install, making sure Internet Explorer is closed. You won't see anything happen. Give it a minute to do it's stuff,

Please download the trial version of Ewido Security Suite from here. Install it and update the program with the latest definitions. Setup the program following the instructions here and then close it without running a scan.

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files,

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #4 to Merge Winlogon Notify Defaults, Press enter, wait a few momentsNow select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT:Do NOT run any other files in the l2mfix folder until you are asked to do so!

The following are the files found: ****************************************************************************

Registry Entries that were Deleted: Please verify that the listing looks ok. If there was something deleted wrongly there are backups in the backreg folder. ****************************************************************************REGEDIT4

I have not had a chance to do these last steps yet this morning because I am on deadline, but I will do this in a couple of hours and let you know how it is running. I can't tell you the last time I didn't see the norton pop up for Trojan.Stwole message pop up on my screen. How frustrating that it could see it but not fix it. I am so appreciative of your help.